On Wed, Apr 13, 2016 at 12:24:50PM -0400, Scot Needy wrote: > Does not look like I’m getting data into es. How could I tell does data=false mean it’s not storring ? no, data=false means syslog-ng won't create shards in its ES instance, which is perfectly normal and expected